]> rtime.felk.cvut.cz Git - jailhouse.git/log
jailhouse.git
9 years agodriver: Improve input validation to make code scanners happier
Jan Kiszka [Tue, 10 Mar 2015 06:27:43 +0000 (07:27 +0100)]
driver: Improve input validation to make code scanners happier

We trust the configuration files passed down to the driver already
because they define the isolation set up by the hypervisor and can
therefore screw up the system in various ways.

Nevertheless, we can and should improve basic consistency checks of
config fields that influences allocations and copy operations. This will
detect some corruptions/inconsistencies earlier and also satisfies the
Coverity scanner.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: Silence sparse warnings about incompatible address spaces
Jan Kiszka [Tue, 10 Mar 2015 13:26:55 +0000 (14:26 +0100)]
driver: Silence sparse warnings about incompatible address spaces

All conversion cases are harmless, just ensure that sparse is told this.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Address sparse warnings about missing UL tags for constants
Jan Kiszka [Tue, 10 Mar 2015 13:09:23 +0000 (14:09 +0100)]
x86: Address sparse warnings about missing UL tags for constants

Automatic type conversion saved us in all these cases so far, but better
avoid surprises in the future and another finding turned out to be a bug
in fact.

JAILHOUSE_BASE requires special wrapping as it is also used in assembly
(the linker script) where the UL tag is not understood.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Make target_cpu_map static
Jan Kiszka [Mon, 9 Mar 2015 22:38:42 +0000 (23:38 +0100)]
arm: Make target_cpu_map static

No user outside of this file.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Remove spurious inline tags from function prototypes
Jan Kiszka [Mon, 9 Mar 2015 22:33:12 +0000 (23:33 +0100)]
arm: Remove spurious inline tags from function prototypes

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Silence sparse warning about non-ANSI function declaration
Jan Kiszka [Mon, 9 Mar 2015 22:30:37 +0000 (23:30 +0100)]
x86: Silence sparse warning about non-ANSI function declaration

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agocore: Ensure consistent function attributes
Jan Kiszka [Mon, 9 Mar 2015 22:25:16 +0000 (23:25 +0100)]
core: Ensure consistent function attributes

Take function attributes also the definition. Silences related sparse
errors.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Fix no-execute tagging of SVM NPT structures
Jan Kiszka [Tue, 10 Mar 2015 09:04:13 +0000 (10:04 +0100)]
x86: Fix no-execute tagging of SVM NPT structures

Two bugs in one: flags is too small, and PAGE_FLAG_EXECUTE is actually
PAGE_FLAG_NOEXECUTE.

Revealed by sparse while walking through a number of "constant XXX is so
big it is unsigned long" warnings.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: Move cell-related services to separate module
Jan Kiszka [Mon, 9 Mar 2015 10:46:00 +0000 (11:46 +0100)]
driver: Move cell-related services to separate module

This moves all cell-related work out of main.c, shrinking it below 500
lines again.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: Factor out sysfs module
Jan Kiszka [Mon, 9 Mar 2015 10:00:47 +0000 (11:00 +0100)]
driver: Factor out sysfs module

Push all functions that build and serve the driver's sysfs view into a
separate module. This reduces the size of main.c significantly and makes
it more readable again.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: Export driver lock and enabled flag
Jan Kiszka [Mon, 9 Mar 2015 09:57:47 +0000 (10:57 +0100)]
driver: Export driver lock and enabled flag

The lock and the flag will be needed outside of main.c.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: Factor out PCI related services
Jan Kiszka [Mon, 9 Mar 2015 08:09:11 +0000 (09:09 +0100)]
driver: Factor out PCI related services

This moves all PCI-related functions in a separate module. Consequently,
the module is only built if PCI is enabled. Encapsulation also
simplifies to include PCI-related fields of struct cell only when used.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: Factor out cell.h
Jan Kiszka [Mon, 9 Mar 2015 08:06:51 +0000 (09:06 +0100)]
driver: Factor out cell.h

Another step towards multiple compilation modules for the driver: this
data structure will be used by most of them.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: Adjust description
Jan Kiszka [Mon, 9 Mar 2015 08:17:27 +0000 (09:17 +0100)]
driver: Adjust description

The driver does more than loading.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agocore: Move config.mk to generated directory
Jan Kiszka [Sun, 8 Mar 2015 19:59:27 +0000 (20:59 +0100)]
core: Move config.mk to generated directory

Analogously to version.h, this moves the generated config.mk to the
proper directory. We can switch from clean-files to clean-dirs for the
header directory at that chance.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agocore/driver: Move version.h to generated directory
Jan Kiszka [Sun, 8 Mar 2015 19:54:13 +0000 (20:54 +0100)]
core/driver: Move version.h to generated directory

Now that we have such a directory, we should also use it for all files
generated during the build. This moves version.h.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agohypervisor: Fix cleaning of generated files for latest kernels
Jan Kiszka [Sun, 8 Mar 2015 19:51:25 +0000 (20:51 +0100)]
hypervisor: Fix cleaning of generated files for latest kernels

Recent kernels seem to add their own prefix to clean-files, thus won't
remove our files as the paths gets wrong. We can simply remove $(obj),
that works both for current and older kernels.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: Move to separate directory
Jan Kiszka [Sun, 8 Mar 2015 19:35:46 +0000 (20:35 +0100)]
driver: Move to separate directory

The top-level directory is starting to fill up, and the driver requires
some split-up into multiple modules. This should better be done in a
dedicated directory.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agobuild: Let inmates depend on hypervisor build unconditionally
Jan Kiszka [Sun, 8 Mar 2015 19:10:51 +0000 (20:10 +0100)]
build: Let inmates depend on hypervisor build unconditionally

$(clean) is no longer set only for clean runs with recent kernels. Thus
the dependency is now never set. At the same time, setting it also for
clean runs causes no unwanted side effects anymore. So remove the test.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Improve readability of JAILHOUSE_CALL_CODE
Jan Kiszka [Mon, 9 Mar 2015 14:09:01 +0000 (15:09 +0100)]
x86: Improve readability of JAILHOUSE_CALL_CODE

Give the symbol we test in JAILHOUSE_CALL_CODE a name and use "jne" as
we are comparing for equality.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Fix hypercall dispatching assembly
Jan Kiszka [Mon, 9 Mar 2015 14:04:21 +0000 (15:04 +0100)]
x86: Fix hypercall dispatching assembly

The macro reads jailhouse_use_vmcall, a bool variable that is mapped on
a byte on x86. Specify the width to avoid that we test more than we
should.

This bug was revealed by adding further global bool variables that
happen to line up after jailhouse_use_vmcall. The current memory layout
may make the issue harmless in practice.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Power off non-root CPUs before shutting down the hypervisor
Jan Kiszka [Sun, 22 Feb 2015 09:26:06 +0000 (10:26 +0100)]
arm: Power off non-root CPUs before shutting down the hypervisor

When handing back a CPU previously used by a non-root cell directly to
Linux during hypervisor shutdown, we have to power it off when Linux is
using PSCI. Otherwise, the CPU_ON command issued by Linux later on to
gain control over the CPU again may not work as expected.

All our supported boards except for the Versatile Express come with PSCI
support. Try both v0.2 and the v0.1 encoding of U-Boot for CPU_OFF. At
least one of them must work.

The GICC is not reset by the power-down, thus we have to reset it shut
it down explicitly.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Add support for Jetson TK1 board
Jan Kiszka [Mon, 16 Feb 2015 19:16:23 +0000 (20:16 +0100)]
arm: Add support for Jetson TK1 board

The Jetson TK1 board uses the NVIDIA K1 processor, namely the Tegra124.
The CPU has 4 Cortex-A15 cores and a low-power companion core which we
do not support, though. This SoC apparently contains all virtualization
features we need, specifically full SMMU coverage of I/O devices.

For now, board support is similar to the Banana Pi: We replicate UART
and SMP/PSCI features and add some configs (only one for both demos as
only one UART is accessible).

Open issues, besides adding SMMU support, are managing the access to the
so-called legacy Interrupt controller of the K1 (an additional stage
between devices and GIC) and sub-page access control to various devices
(same issue as with the Allwinner A20). Also, it becomes clearer than
ever that we urgently need to refactor the UART layer as well as
SMP/PSCI support to reduce duplications.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: Update CR4 on x86 after hypervisor enabling/disabling
Jan Kiszka [Mon, 23 Feb 2015 10:22:32 +0000 (11:22 +0100)]
driver: Update CR4 on x86 after hypervisor enabling/disabling

Linux gained CR4 shadowing in 4.0: it now keeps a software copy of the
mm's CR4 state and only write updates on changes. But this also means it
will miss changes to this register when enabling or disabling Jailhouse.
That will cause sporadic access violations or false reporting of
virtualization-busy CPUs on Jailhouse enable.

Fix it by re-initializing the shadow on x86 after returning from the
hypervisor entry or the disable command. We are still protected from
interrupts at that point, so nothing can leak to other tasks.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: Account for removal of cpumask_scnprintf
Jan Kiszka [Wed, 18 Feb 2015 08:41:58 +0000 (09:41 +0100)]
driver: Account for removal of cpumask_scnprintf

4.0 provides cpumask formatting via the %*pb format specifier.
cpumask_scnprintf was removed. So we need to implement both variants
for staying compatible with older kernels.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoTODO: Add items about MMIO dispatching enhancements
Jan Kiszka [Wed, 18 Feb 2015 08:19:14 +0000 (09:19 +0100)]
TODO: Add items about MMIO dispatching enhancements

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoREADME: Update U-Boot requirement for Banana Pi
Jan Kiszka [Thu, 12 Feb 2015 10:11:53 +0000 (11:11 +0100)]
README: Update U-Boot requirement for Banana Pi

We no longer depend on PSCI v0.2 patches, just on a recent upstream
version.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Add PSCI v0.1 support as provided by U-Boot
Jan Kiszka [Thu, 12 Feb 2015 10:02:42 +0000 (11:02 +0100)]
arm: Add PSCI v0.1 support as provided by U-Boot

Upstream U-Boot will continue to offer only a PSCI v0.1 interface. To
make us independent of patches, add the IDs for CPU_OFF and CPU_ON to
the dispatcher. Those functions are practically compatible between 0.1
and 0.2.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Rename CONFIG_ARCH_* to CONFIG_MACH_*
Jan Kiszka [Thu, 12 Feb 2015 09:15:48 +0000 (10:15 +0100)]
arm: Rename CONFIG_ARCH_* to CONFIG_MACH_*

Based on proposal by Benedikt Spranger: CONFIG_ARCH_SUN7I and
CONFIG_ARCH_VEXPRESS select a machine type, not an architecture. Rename
them to clarify this.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoREADME: Add ARM requirements description
Jan Kiszka [Mon, 9 Feb 2015 08:01:18 +0000 (09:01 +0100)]
README: Add ARM requirements description

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Fix spi_in_cell for SPIs 32..63
Jan Kiszka [Sat, 7 Feb 2015 10:33:58 +0000 (11:33 +0100)]
arm: Fix spi_in_cell for SPIs 32..63

The cell configuration format restricts us to 64 SPIs this far. Make
sure that we properly test the range of 32 to 63 and avoid overflows due
to 32-bit word width. As Jailhouse provides no __aeabi_llsr, extract
high and low words first, then scan within 32 bits.

This addresses Coverity finding CID 21110.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Stop relying on little endian ordering for GICH_ELSRn scan
Jan Kiszka [Sat, 7 Feb 2015 10:18:13 +0000 (11:18 +0100)]
arm: Stop relying on little endian ordering for GICH_ELSRn scan

Arrange ELSR0 and ELSR1 in an array of unsigned longs to avoid that the
code breaks on a big endian target.

This addresses Coverity finding CID 21112.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Fix off-by-one in gic_probe_cpu_id
Jan Kiszka [Sat, 7 Feb 2015 10:10:01 +0000 (11:10 +0100)]
arm: Fix off-by-one in gic_probe_cpu_id

We support up to 8 CPUs, not 9. Avoid future overflows by using the
actual size of target_cpu_map as limit.

This addresses Coverity finding CID 21114.

Adjust comment wordings at this chance as well.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoAdd Coverity scan to README and contribution process
Jan Kiszka [Fri, 6 Feb 2015 14:19:30 +0000 (15:19 +0100)]
Add Coverity scan to README and contribution process

Integrate the code scan via Coverity in our documentation and the also
the contribution process.

Not all patches may require a scan prior to posting, thus only recommend
this step for contributors for now. A scan will now always be performed
for code changes before accepting them into master.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoci: Select single configuration for Coverity scan via branch name
Jan Kiszka [Fri, 6 Feb 2015 20:08:48 +0000 (21:08 +0100)]
ci: Select single configuration for Coverity scan via branch name

As scan results of generic files are overwritten with the last
configuration build, allow to pick a specific config for stand-alone
analysis. This comes at the price of overwriting results on the project
page but is still better than missing something subtle.

To differentiate the snapshot in Coverity, patch the description that is
attached to the upload.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoci: Include all configurations in Coverity scan
Jan Kiszka [Fri, 6 Feb 2015 13:08:56 +0000 (14:08 +0100)]
ci: Include all configurations in Coverity scan

Coverity only provides us as OSS project a single "stream", thus a
single configuration for our project. But we already have 3. However,
we can accumulate results to a certain degree with some tricks: We have
to ensure that the intermediate "make clean" runs are not tracked by
cov-build, the build tracker of Coverity.

That's why we overload the default scan-build script of Travis CI and
Coverity, obtain the original one from our script, patch that version
to run our build script in a way that we have control over what gets
tracked and what not. Nasty, but seems to work sufficiently for now.

In addition, we need to register the ARM cross-compiler via
cov-configure.

At this chance: "description" is no longer used by Coverity - drop it.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoci: Do not perform regular build for Coverity scan
Jan Kiszka [Fri, 6 Feb 2015 13:07:27 +0000 (14:07 +0100)]
ci: Do not perform regular build for Coverity scan

There is no need to run the script step when we only want to collect
data via the coverity_scan add-on.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoci: Use script for building all configurations
Jan Kiszka [Fri, 6 Feb 2015 12:32:16 +0000 (13:32 +0100)]
ci: Use script for building all configurations

This will ease the maintenance when we start to use it for the Coverity
build as well.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoci: Beautify travis script
Jan Kiszka [Fri, 6 Feb 2015 12:22:16 +0000 (13:22 +0100)]
ci: Beautify travis script

Adjust whitespaces, comment installation steps, use pushd/popd for
switching directories.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoinmates: Switch IOAPIC demo from power button to timer interrupt source
Jan Kiszka [Tue, 3 Feb 2015 16:50:29 +0000 (17:50 +0100)]
inmates: Switch IOAPIC demo from power button to timer interrupt source

This simplifies testing as no more manual triggering is required.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Return an initialized value from AMD iommu_get_remapped_root_int
Jan Kiszka [Tue, 3 Feb 2015 06:02:41 +0000 (07:02 +0100)]
x86: Return an initialized value from AMD iommu_get_remapped_root_int

This is just to please code scanners, the function isn't called yet
(iommu_cell_emulates_ir always returns false).

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Clean up and document cpu_suspended setting in arch_panic_stop
Jan Kiszka [Mon, 2 Feb 2015 12:41:29 +0000 (13:41 +0100)]
x86: Clean up and document cpu_suspended setting in arch_panic_stop

Document why we manipulate cpu_suspended outside of the per-cpu lock and
drop the superfluous memory barrier. Nothing has to be ordered here, we
just do a full stop and try to avoid that some other CPU will wait
infinitely on us to finish "suspension".

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Avoid theoretical race between CPU suspension and arch_resume_cpu
Jan Kiszka [Mon, 2 Feb 2015 12:27:43 +0000 (13:27 +0100)]
x86: Avoid theoretical race between CPU suspension and arch_resume_cpu

Conceptually, we avoid this race by synchronizing on cpu_suspended in
arch_suspend_cpu. However, to ease the analysis by both humans and code
scanners, let's apply the lock around the manipulation. Lock acquisition
also includes the required memory barrier so that we can drop the
explicit one.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agotools: jailhouse: Fully initialize cell_id structure
Jan Kiszka [Mon, 2 Feb 2015 11:47:06 +0000 (12:47 +0100)]
tools: jailhouse: Fully initialize cell_id structure

This mostly helps code checkers to stop believing we are copying
uninitialized data around, even if it is semantically unused.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: Fix uninitialized return code of jailhouse_cell_create
Jan Kiszka [Mon, 2 Feb 2015 10:24:28 +0000 (11:24 +0100)]
driver: Fix uninitialized return code of jailhouse_cell_create

Found by Coverity: In case no CPUs of a new cell need to be offlined, we
left err uninitialized. Fix this.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoci: Add Coverity scan
Jan Kiszka [Mon, 2 Feb 2015 09:15:28 +0000 (10:15 +0100)]
ci: Add Coverity scan

This only processes x86 code so far as Coverity also relies on binary
outputs to at least trigger the scan. We will have to decide to develop
a workaround or switch to a matrix build (including redundant
environment setups).

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoinmates: Power-up PHY on E1000 takeover
Jan Kiszka [Sun, 1 Feb 2015 10:38:18 +0000 (11:38 +0100)]
inmates: Power-up PHY on E1000 takeover

Clear the power-down bit in the PHY control register in case the
previous user turned it off. Linux does so since about 3.15.

Note that we do not try to reset the PHY. Getting it running again with
the proper link speed turned out to be too complicated (too many PHY
variants) for this little demo.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoconfigs: Prepare f2a8xm-hd3 cell to multi-IOAPIC
Valentine Sinitsyn [Sun, 1 Feb 2015 12:18:40 +0000 (17:18 +0500)]
configs: Prepare f2a8xm-hd3 cell to multi-IOAPIC

The board has two IOAPICs, and now as Jailhouse supports more than
one of these chips, they can be safely added to the config.

Signed-off-by: Valentine Sinitsyn <valentine.sinitsyn@gmail.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agotools: Close files after use in config generator
Jan Kiszka [Wed, 28 Jan 2015 09:58:58 +0000 (10:58 +0100)]
tools: Close files after use in config generator

Just to be clean and to avoid piling up unused resources. In some cases
we already did so, in one we were using the with statement. Now the
remaining perform the close as well.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agotools: config create: add assertions in DMAR parser
Henning Schild [Tue, 27 Jan 2015 14:05:34 +0000 (15:05 +0100)]
tools: config create: add assertions in DMAR parser

Assert for some of the comments from the VT-d manual, might help to
detect invalid ACPI tables.

Signed-off-by: Henning Schild <henning.schild@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agotools: config create: add PCI-PCI bridge support to DMAR parser
Henning Schild [Tue, 27 Jan 2015 14:05:33 +0000 (15:05 +0100)]
tools: config create: add PCI-PCI bridge support to DMAR parser

Implement "PCI Sub-hierarchy" scope in DMAR parser.

Signed-off-by: Henning Schild <henning.schild@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agotools: config create: Comments and style, no functional changes
Henning Schild [Tue, 27 Jan 2015 14:05:32 +0000 (15:05 +0100)]
tools: config create: Comments and style, no functional changes

Add comments to help make some sense out of the scope type numbers.

Signed-off-by: Henning Schild <henning.schild@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agotools: config create: break out of pci device iteration after first hit
Henning Schild [Tue, 27 Jan 2015 14:05:31 +0000 (15:05 +0100)]
tools: config create: break out of pci device iteration after first hit

The list of PCI devices contains only one entry per bdf, break out of
loop after finding it.

Signed-off-by: Henning Schild <henning.schild@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agotools: config create: do not use the class file of pci devs anymore
Henning Schild [Tue, 27 Jan 2015 14:05:30 +0000 (15:05 +0100)]
tools: config create: do not use the class file of pci devs anymore

The class file just contains the classcode. Since we started also using
the file containing the whole PCI config space we might as well get the
class information from there and copy/access less input files.

Signed-off-by: Henning Schild <henning.schild@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agotools: config-create: fix pep8 style violations
Henning Schild [Tue, 27 Jan 2015 14:05:29 +0000 (15:05 +0100)]
tools: config-create: fix pep8 style violations

Signed-off-by: Henning Schild <henning.schild@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoi8042: remove unreachable condition from if statement
Henning Schild [Tue, 27 Jan 2015 14:05:28 +0000 (15:05 +0100)]
i8042: remove unreachable condition from if statement

the size check was already done earlier in the function

Signed-off-by: Henning Schild <henning.schild@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: use min macro from Linux instead of defining another one
Henning Schild [Tue, 27 Jan 2015 14:05:27 +0000 (15:05 +0100)]
driver: use min macro from Linux instead of defining another one

Signed-off-by: Henning Schild <henning.schild@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Switch to ticket spinlocks
Jan Kiszka [Tue, 27 Jan 2015 10:09:21 +0000 (11:09 +0100)]
x86: Switch to ticket spinlocks

ARM already has it, x86 should gain it as well: To avoid the risk of
unfair lock assignment or even starvation in excessive contention
scenarios, switch to the ticket-based spinlock algorithm that also Linux
uses. Our implementation is a condensed version of the kernel as we do
not have to take para-virtual optimizations and instrumentations into
account.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Account for multiple IOAPICs per cell
Jan Kiszka [Mon, 26 Jan 2015 12:25:48 +0000 (13:25 +0100)]
x86: Account for multiple IOAPICs per cell

Finally overcome the limitation of only one IOAPIC per cell, thus also
per system. We either look up the IOAPIC from the cell array based on
its physical address or we iterate over all IOAPICs of a cell when
needed - that's all. A good sign that we achieved this is the removal of
the IOAPIC_BASE_ADDR constant.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Introduce per-cell IOAPIC state
Jan Kiszka [Mon, 26 Jan 2015 10:02:36 +0000 (11:02 +0100)]
x86: Introduce per-cell IOAPIC state

This introduces per-cell IOAPIC static and dynamic information. It
replaces related cell fields with a reference to an array of cell_ioapic
structures. As we do not want to keep a large array for every cell, even
for those that do not use the IOAPIC (typically all non-root cells), the
array is stored in a page allocated on demand during cell creation.

Using this abstraction obsoletes ioapic_find_config and moves us a bit
further away from the assumption that there is only a single IOAPIC.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Prepare ioapic_shutdown for multiple IOAPICs
Jan Kiszka [Mon, 26 Jan 2015 09:23:00 +0000 (10:23 +0100)]
x86: Prepare ioapic_shutdown for multiple IOAPICs

Iterate over all physical IOAPICs during shutdown to write their
shadow states into the hardware.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Set up physical IOAPIC on cell creation
Jan Kiszka [Mon, 26 Jan 2015 09:07:58 +0000 (10:07 +0100)]
x86: Set up physical IOAPIC on cell creation

In preparation to support multiple IOAPICs, instantiate their physical
state phys_ioapic only on demand during cell creation. For simplicity
reasons, those instances will not be released on cell destruction again.
That means, once created, physical IOAPIC states and mappings stay with
the hypervisor until it is disabled again.

Note: Parts of the code keep their single-IOAPIC restrictions for now.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Introduce phys_ioapic abstraction
Jan Kiszka [Sun, 25 Jan 2015 20:57:19 +0000 (21:57 +0100)]
x86: Introduce phys_ioapic abstraction

This structure will keep static and dynamic information about a physical
IOAPIC in a system. The three global variables ioapic_lock, ioapic and
shadow_redir_table are moved over, and an array of phys_ioapic
structures takes over their place. There is still only a single instance
supported, but once we have more, the physical base address will be used
to differentiate between them and also look them up from the array.

Internal functions of the IOAPIC subsystem are converted to make use of
the abstraction.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agocore: Make for_each_[non_root_]cell globally available
Jan Kiszka [Sun, 25 Jan 2015 10:19:29 +0000 (11:19 +0100)]
core: Make for_each_[non_root_]cell globally available

We are going to use the for_each_cell iterator in the IOAPIC module. To
remain consistent, export both of them.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Filter out unsupported numbers of irqchips
Jan Kiszka [Sat, 24 Jan 2015 07:54:48 +0000 (08:54 +0100)]
x86: Filter out unsupported numbers of irqchips

So far we only support a single IOAPIC per cell on x86. Soon this number
will be increased significantly, but a limit will remain. Filter out any
unsupported configurations during cell-specific IOAPIC setup.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agotools: Extend config generator to process multiple IOAPICs
Jan Kiszka [Sat, 24 Jan 2015 06:41:25 +0000 (07:41 +0100)]
tools: Extend config generator to process multiple IOAPICs

As a first step towards full support of more than one IOAPIC, extend the
config generator to process multiple IOAPIC entries in the DMAR table.
It used the MADT ("APIC") table to collect further information about the
found IOAPICs and lists them all in the irqchips array.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Only hand over IOAPICs pins to the root cell that are in use
Jan Kiszka [Sun, 25 Jan 2015 09:28:31 +0000 (10:28 +0100)]
x86: Only hand over IOAPICs pins to the root cell that are in use

Use the bitmap of currently assigned IOAPIC pins to hand them over to
the root cell, not those that are initially assigned. That makes a
difference when shutting down the hypervisor while some pins are still
owned by a non-root cell. During startup, both bitmaps are identical.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Fix error roll-back for vtd
Jan Kiszka [Wed, 28 Jan 2015 07:01:04 +0000 (08:01 +0100)]
x86: Fix error roll-back for vtd

If we fail the hypervisor setup before vtd_init_unit was run, we must
not try to restore anything during iommu_shutdown. This happened to far
and caused Linux crashes as well as spurious NMI injections.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agox86: Move vtd_init_fault_nmi from cell creation to config commit
Jan Kiszka [Wed, 28 Jan 2015 06:53:41 +0000 (07:53 +0100)]
x86: Move vtd_init_fault_nmi from cell creation to config commit

This avoids that we change the DMAR unit settings before the setup
process succeeded. Will help to fix the roll-back on errors.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodriver: Avoid vmalloc(0) on creation of cells without PCI devices
Jan Kiszka [Fri, 16 Jan 2015 16:36:56 +0000 (17:36 +0100)]
driver: Avoid vmalloc(0) on creation of cells without PCI devices

The kernel does not like this pattern and may throw warnings.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoRevert "x86/tools/inmates: Account for 32-bit PM timers"
Henning Schild [Wed, 26 Nov 2014 10:12:08 +0000 (11:12 +0100)]
Revert "x86/tools/inmates: Account for 32-bit PM timers"

This reverts commit 6cd05b8f9b3f97998d7a4c857584dbfc5ef901f9.

Another way of dealing with 32-bit PM timers is to just pretend they
where 24-bit long. That is what an earlier patch does for jailhouse, so
this one is not required anymore.

Signed-off-by: Henning Schild <henning.schild@siemens.com>
Conflicts:
inmates/lib/x86/inmate.h
inmates/lib/x86/timing.c

[Jan: remove pm_timer_init also from ivshmem-demo]
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoinmates: x86: mask pm_timer to 24bits
Henning Schild [Wed, 26 Nov 2014 10:12:07 +0000 (11:12 +0100)]
inmates: x86: mask pm_timer to 24bits

Operate any pm_timer in 24bit mode, even if it is 32bit capable. Linux
also just looks at the lower 24.
That simplyfies the code and we can deal with 24bit timers where the
ACPI tables claim they where 32bit wide.

Signed-off-by: Henning Schild <henning.schild@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoconfigs: Remove obsolete chromebook config
Jan Kiszka [Fri, 16 Jan 2015 08:14:52 +0000 (09:14 +0100)]
configs: Remove obsolete chromebook config

This was never completed and most likely will never be. Drop it.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoconfigs: Adjust QEMU config to use VGA instead of Cirrus
Jan Kiszka [Mon, 12 Jan 2015 08:33:49 +0000 (09:33 +0100)]
configs: Adjust QEMU config to use VGA instead of Cirrus

VGA became the standard video adapter in QEMU 2.2. Adjust the config
accordingly.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoConvert to TODO.md
Jan Kiszka [Sun, 11 Jan 2015 16:09:27 +0000 (17:09 +0100)]
Convert to TODO.md

Make this file markdown-friendly as well.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoUpdate TODO
Jan Kiszka [Sun, 11 Jan 2015 15:37:29 +0000 (16:37 +0100)]
Update TODO

Remove recently completed or obsoleted items, add details on next steps
about inter-cell communication.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agodocs: Add CONTRIBUTING.md
Jan Kiszka [Fri, 9 Jan 2015 19:15:21 +0000 (20:15 +0100)]
docs: Add CONTRIBUTING.md

Specify the contribution cycle in form of a checklist and a sketched
integration process. Also list people with specific responsibility areas
that should be involved on their topics.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agotooling: Detect too old make version
Jan Kiszka [Fri, 9 Jan 2015 17:59:42 +0000 (18:59 +0100)]
tooling: Detect too old make version

Massaged version of Hans' original patch: Since d0ca500b we depend on
make >= 3.82. That can be a problem for oldish distributions. Better
catch it early.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoREADME: Add link to Travis CI
Jan Kiszka [Mon, 5 Jan 2015 08:42:50 +0000 (09:42 +0100)]
README: Add link to Travis CI

Link to out continuous integration service, including build status
visualization that github renders for us when displaying the README.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoREADME: Add information about Banana Pi setup
Jan Kiszka [Fri, 2 Jan 2015 16:14:21 +0000 (17:14 +0100)]
README: Add information about Banana Pi setup

Describe how to set up and run Jailhouse with inmates on the Banana Pi
board. This is currently our physical reference for ARM systems.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoREADME: Adjust to markdown format
Jan Kiszka [Fri, 2 Jan 2015 13:37:43 +0000 (14:37 +0100)]
README: Adjust to markdown format

Perform some reformatting so that we can present the README as markdown
file for nicer visualization on github. Also prepare for ARM addition
and adjust the kernel version requirement of x86 at this chance.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoci: Add Travis CI infrastructure
Jan Kiszka [Thu, 1 Jan 2015 12:58:08 +0000 (13:58 +0100)]
ci: Add Travis CI infrastructure

Based on Roger Meier's proposal, this adds support for testing Jailhouse
builds on Travis CI (travis-ci.org). The major differences to Roger's
approach are:
 - Linux kernels are pre-built and pushed as archive to a webserver
 - all target variants (x86, Banana Pi, Versatile Express) are built in
   a single run to limit archive downloads
 - required kernel and Jailhouse configs become part of our tree

The kernel archive can be generated via ci/gen-kernel-build.sh in an
environment comparable to the Travis CI VMs. See ci/README.md for more
information.

CC: Roger Meier <r.meier@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Clear virtual GICs before handing them over to Linux during setup
Jan Kiszka [Fri, 26 Dec 2014 10:52:04 +0000 (11:52 +0100)]
arm: Clear virtual GICs before handing them over to Linux during setup

Previous users of the virtual GICs may have left them with pending
interrupts or raised priority levels. Fix this up before starting Linux
under Jailhouse control. Otherwise we risk to inject spurious interrupts
or stall interrupt delivery to Linux.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Implement PSCI_AFFINITY_INFO_32
Jan Kiszka [Sat, 20 Dec 2014 11:11:44 +0000 (12:11 +0100)]
arm: Implement PSCI_AFFINITY_INFO_32

Linux uses it to check if a CPU is really dead and at least dumps
warnings on the console if this function fails. It is mandatory to
implement according to the spec.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Wait for CPU to stop in arch_suspend_cpu
Jan Kiszka [Fri, 19 Dec 2014 15:25:42 +0000 (16:25 +0100)]
arm: Wait for CPU to stop in arch_suspend_cpu

The semantic of arch_suspend_cpu is synchronous, i.e. it has to wait
until the target CPU was actually suspended. Extend the ARM
implementation accordingly.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Clean up psci_cpu_stopped usage
Jan Kiszka [Fri, 28 Nov 2014 14:16:46 +0000 (15:16 +0100)]
arm: Clean up psci_cpu_stopped usage

psci_cpu_stopped returns a bool, so let's use it like this.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoinmates: arm: Enhance gic-demo with latency statistics
Jan Kiszka [Mon, 15 Dec 2014 17:02:49 +0000 (18:02 +0100)]
inmates: arm: Enhance gic-demo with latency statistics

Original version by Johann Pfefferl: This transfers the apic-demo to
ARM by letting the timer tick at 10 Hz and print jitter statistics on
each event. In addition, this also lets the green LED on the Banana Pi
blink.

CC: Johann Pfefferl <johann.pfefferl@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Open clock gate on UART setup
Jan Kiszka [Sun, 14 Dec 2014 17:28:34 +0000 (18:28 +0100)]
arm: Open clock gate on UART setup

Add the infrastructure to open a clock gate on UART configuration. This
is particularly helpful if Linux drivers close the gate when releasing
the device.

For now the assumption is that a clock gate can be described by a single
bit in a specific register.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Add support for Banana Pi board
Jan Kiszka [Wed, 12 Nov 2014 12:01:43 +0000 (13:01 +0100)]
arm: Add support for Banana Pi board

The Banana Pi is a cheap ARMv7 board with a dual-core Cortex-A7, thus
with virtualization support. Upstream U-boot and kernel work fine -
ideal conditions. We just lack some IOMMU on that board, but it remains
handy for testing purposes.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Rework return to EL1 path
Jan Kiszka [Tue, 25 Nov 2014 08:06:42 +0000 (09:06 +0100)]
arm: Rework return to EL1 path

Refactor cpu_return_el1 to cpu_prepare_return_el1, moving the differing
parts depending on the return mode to the caller site. Ensure that we
return to Linux passing the proper error code - it's now available to
arch_cpu_restore.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agocore: Pass return code to arch_cpu_restore
Jan Kiszka [Tue, 25 Nov 2014 08:02:45 +0000 (09:02 +0100)]
core: Pass return code to arch_cpu_restore

Some architectures, so far ARM, may prefer to jump directly to the
target Linux context from arch_cpu_restore. In this case we need to have
the return code at hand as well. Extend the parameter list accordingly
and document the possibility that arch_cpu_restore does not return to
the caller.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Account for irqchip_cell_exit being called before irqchip_init
Jan Kiszka [Fri, 21 Nov 2014 20:00:28 +0000 (21:00 +0100)]
arm: Account for irqchip_cell_exit being called before irqchip_init

If the hypervisor setup procedures fails before irqchip_init was called,
arch_shutdown will still invoke irqchip_cell_exit. If we run this
function, we'll crash latest when trying to access the not yet mapped
GIC. Leave irqchip_cell_exit early in this case.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Switch to generic UART mapping
Jan Kiszka [Sun, 12 Oct 2014 15:50:12 +0000 (17:50 +0200)]
arm: Switch to generic UART mapping

Start using the generic UART mapping by the Linux driver. For this the
VExpress config has to gain physical base and size information of the
debug UART.

This removed the tedious need to adjust UART_BASE_VIRT in platform.h
according to the Linux configuration.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agocore/driver: Add support for mapping the debug UART from the driver
Jan Kiszka [Sun, 12 Oct 2014 14:52:31 +0000 (16:52 +0200)]
core/driver: Add support for mapping the debug UART from the driver

If the debug UART is memory-mapped, we can only access prior to
switching to hypervisor mappings if the driver supports us in this. By
adding a debug_uart memory region to the system configuration, we tell
the driver about the mapping need. In turn, the driver reports the
virtual address via an additional header field. The mapping can be
released on Linux side right after enabling the hypervisor

Provided the virtual address of the UART mapping as chosen by Linux does
not conflict with our remapping region, this mapping can safely be
replicated into the hypervisor address space so that we don't need to
adjust the UART access after enabling our own mapping.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agocore: Redefine PAGE_FLAG_UNCACHED to PAGE_FLAG_DEVICE
Jan Kiszka [Sun, 12 Oct 2014 14:13:49 +0000 (16:13 +0200)]
core: Redefine PAGE_FLAG_UNCACHED to PAGE_FLAG_DEVICE

All (x86) users of this page flag map devices into the hypervisor
address space. We will do the same for ARM when mapping the debug UART.
For this we need a generic flag with the same semantics. As uncached is
different from device mappings, redefine the semantic of UNCACHED flag
for this purpose.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Remove unused phys_base from uart_chip
Jan Kiszka [Sun, 12 Oct 2014 13:57:53 +0000 (15:57 +0200)]
arm: Remove unused phys_base from uart_chip

This field is write-only, the UART driver is only interested in the
virtual address.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agocore: Refactor arch-specific section definition
Jan Kiszka [Sun, 12 Oct 2014 13:54:05 +0000 (15:54 +0200)]
core: Refactor arch-specific section definition

Require all archs to define ARCH_SECTIONS via asm/section.h, at least an
empty one. Include this unconditionally in the hypervisor layout.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Stop misusing JAILHOUSE_MEM_DMA for marking MMIO
Jan Kiszka [Sat, 11 Oct 2014 13:00:21 +0000 (15:00 +0200)]
arm: Stop misusing JAILHOUSE_MEM_DMA for marking MMIO

Introduce JAILHOUSE_MEM_IO so that archs that need to tag MMIO regions
have a proper flag. Apply it on ARM.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoarm: Adjust UART_BASE_VIRT according to local test configuration
Jan Kiszka [Mon, 29 Sep 2014 10:49:34 +0000 (12:49 +0200)]
arm: Adjust UART_BASE_VIRT according to local test configuration

It's almost pointless to tune this constant as it is highly dependent on
the local kernel config. However, this one helps local testing until we
have a better solution for getting the UART mapped for the hypervisor
during early setup.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
9 years agoinmates: arm: Fix and improve build
Jan Kiszka [Mon, 29 Sep 2014 10:37:29 +0000 (12:37 +0200)]
inmates: arm: Fix and improve build

Introduce and use DECLARE_TARGETS just like x86 does. This prevents
unconditional rebuilding of the inmates on every make. Also move the
filtering of "-include asm/unified.h" into reusable Makefile.lib.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>